[PR] fix(release): pin license-eye instead of taking it from PATH [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng opened a new pull request, #134:
URL: https://github.com/apache/skywalking-horizon-ui/pull/134

   ## Why
   
   The 1.0.0 release failed at `licenses:bin:check` with a large diff in the binary LICENSE — package "names" rendered as `../../../node_modules/.pnpm/…` paths, duplicated entries, and a `SEE LICENSE IN LICENSE` licence group.
   
   None of that is the dependency tree. It is the **tool**: the release machine had Homebrew's **license-eye 0.8.0** on `PATH`, which predates the pnpm resolver, so every package resolved through npm's layout. Measured on this repo:
   
   ```
   0.8.0        2,976 rows carrying a path instead of a name
   pinned build         0
   ```
   
   The binary LICENSE is *generated* by license-eye, so a different build produces a different file and the drift gate compares the tool against itself rather than the committed reference against the dependency tree.
   
   CI has always installed a pinned commit (`ci.yaml`), which is why this passed there and failed only in the release. The release script just checked that *some* `license-eye` existed on `PATH` and used it. I added the pin to CI when the generation moved to license-eye and did not add it here — this closes that gap.
   
   ## What
   
   `.license-eye-version` holds the pinned commit, and **both** CI and `release.sh` read it, so they cannot drift apart again.
   
   `release.sh` installs it into `scripts/.release-tools` and prepends that to `PATH`. That directory is deliberately **not** under the work directory: `release.sh` does `rm -rf "${WORK_DIR}"` when it makes the release clone, which would delete the binary halfway through the run — I hit that on the first attempt.
   
   `go` joins the required-tool check since the install needs it, and `license-eye` leaves it: a `PATH` copy is no longer consulted at all.
   
   ## Validation
   
   - `pnpm licenses:bin:check` — the step that failed the release — now exits 0 with the pinned build.
   - The install path was dry-run exactly as the script does it: `go install …@$(cat .license-eye-version)` into `scripts/.release-tools`, then a `dep resolve` returning **0** path-rows.
   - Full gate: type-check, lint, 2,374 unit tests, `pnpm package`, `licenses:bin:check`, `license-eye header check` (1661 files, 0 invalid), `bash -n scripts/release.sh`.
   - `.license-eye-version` is a bare SHA, so it is added to `paths-ignore` — a licence header would have to be stripped by both readers.
   
   ## Note for anyone running a release
   
   Running the old 0.8.0 against this workspace also leaves `package-lock.json` files behind in `packages/*` — it shells out to `npm ci` in a pnpm workspace. Two appeared while I was reproducing this and were removed; `pnpm install --frozen-lockfile` restores the workspace. The pinned build does not do this.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(release): pin license-eye instead of taking it from PATH [skywalking-horizon-ui]

["wu-sheng (via GitHub)" <gi...@apache.org>]

wu-sheng merged PR #134:
URL: https://github.com/apache/skywalking-horizon-ui/pull/134


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org